Method for testing a software application

ABSTRACT

To test a software application, a method submits an electronic board including a component implementing an application to a laser radiation generated in test equipment. The component is excited with laser pulses having very short durations distributed during complex operational phases of the component for running the application, and the reaction of the component and the application are observed.

This invention relates to a method for testing a software application.It can be used to test electronic boards and for any applicationimplemented by such boards. The electronic boards targeted by thisinvention are mainly those subjected to external energy interactions.The term software application refers to a digital or analogue processingoperation for input data to produce output data. The input data can bein the form of measurements originating from a measuring element orelectrical states of such an element, mounted or not onto the board. Theoutput data is either the same type of data as the input data, havingbeen corrected or transformed, data attributes of this data, or actuatorcontrols driven by the electronic board. An electronic board differsfrom an electronic component in the sense that it can include a set ofelectronic components used by the logistics for maintaining in operationa main component mounted onto the board. An electronic board isessentially comprised of a connector or connection device enabling theboard to be connected inside an apparatus.

The correct operation of the electronic components, typically of theintegrated electronic circuits, can be disturbed by the environment inwhich they exist, for example a natural or artificial radiationenvironment or an electromagnetic environment. External aggressionscreate eddy currents by interacting with the component's constituentmaterial. These currents can cause a transient or permanent malfunctionof the component and the application used by it.

For a natural radiation environment, these effects, generically known assingle event effects, are created by particles. For example, heavy ionsand protons in space affect the electronic equipment of satellites andlaunch vehicles. At lower altitudes, where aeroplanes circulate, thepresence of neutrons is noted, which also create single event effects.On the ground, such aggressions can also be found and affect electroniccomponents, whether this is due to particles from the naturalenvironment, radioactive particles present in the casings, problemsrelated to immunity, signal integrity, thermal instabilities andmethods. In the following paragraphs, the effects originating fromparticles will be considered in more detail, however the invention alsoapplies to the same types of effects created by different and variedenvironments.

In a general manner, different types of single event effects can bedistinguished:

-   -   transient faults: a transient current created by ionisation        causes either a transient current which spreads over the        circuit, or a change of one or several electrical states (for        the case of a memory or registry). In the previous example, the        effect is described as transient as, if the content of the        memory or registry is rewritten, the error disappears;    -   permanent faults requiring an intervention which was not        provided for within the normal operating conditions of the        application, for example reconfiguring the software or        performing an intervention on the power supply (shutdown then        restart). Following this intervention, the component operates        correctly;    -   destructive effects leading to the definitive shutdown of the        component.

All of these faults produced in the component do not have an immediateor delayed effect on the application, as the different resources of thecomponent are not necessarily used or solicited at the same time. Thereis therefore a problem in determining whether a fault produced in thecomponent has a harmful effect on a software application driven by thiscomponent, mounted onto an electronic board, or whether the latter isable to overcome this.

In addition, the equipment or system architecture can offer a certainlevel of protection. The integrated applications therefore include acertain level of tolerance to faults which should be quantified. Thisquantification is not yet available at this time.

A certain number of methods and techniques regarding equipment,operating systems and application software enable an integratedapplication to be protected with regards to transient and permanentfaults. These are called mitigation techniques. The invention relatesmore specifically to a method enabling application fault tolerance andmitigation techniques regarding the transient and permanent effectswhich affect logic and analogue electronic components to be assessed andvalidated.

An electronic component can be made up of, among other examples, a usermemory area, a memory area required for its configuration, softwareresources enabling operations to be performed, resources required forcommunication between the different logic blocks and resources requiredfor communication between this component and its environment.

The applications based on logic or analogue components have a certainlevel of tolerance to faults, that is to say that some faults created inthe silicon will not have any visible consequences on the application.For example, in the event of a change in the state of a memory cell, ifthis cell is not used by the application before being rewritten, noerror will be produced in the application. In this event, there istherefore an important difference between testing a component, whichthus reveals a malfunction, and testing an application, which, under thesame conditions, does not malfunction.

Similarly in combinatory logic (for example at the heart of amicroprocessor), an eddy current can spread over a series of logic gatesand subside and disappear without ever being stored in a registry.However, if all of the applications have a certain level of tolerance tofaults, the designer faces the problem of quantifying this tolerancelevel so as to apply an accurate level of mitigation.

Numerous mitigation methods can be implemented so as to limit, prevent,detect and/or correct the effects which can cause transient faults andpermanent faults to the application.

Some methods are thus known, aiming at detecting and/or correcting thefaults which can appear in logic circuits so as to prevent failuresoccurring in the application using the component. Error correction codescan be quoted as an example of this, which enable one or several errorsto be detected and corrected. The most complex error correction codescan detect and correct several errors simultaneously. Other mitigationtechniques include the periodic rewriting of data or the periodicverification of data susceptible of being corrupted and followed by therewriting of this data if an error is detected.

There are also methods concerning the board, equipment or system, whichwill not correct or detect a fault, but prevent it from causing systemfailures. Redundancy methods can be quoted as an example of this, (thismore often refers to triplication) with the voting system. These methodsare based on redundancy, either physical redundancy regarding the numberof circuits produced, or temporal redundancy, of all or part of theresources performing the application operations. A voting system,positioned upstream and on the supposition that an error appears at thelevel of one of the duplicated resources, prevents an error from havinga consequence on the operation performed by the component or the board.

Multiple errors are also possible and are becoming more and morefrequent in new memory technologies. Correcting these errors requireserror correction codes to be much further developed (Reed Solomon typeerror correction codes), which are detrimental to applicationperformance. When possible, methods for physically separating resourcesare implemented so as to prevent an event from modifying two physicallyclose resources at the same time. Nevertheless, this separation requiresperfect knowledge of the logic architecture of the component, which isnot always available for the designer.

Finally, the component aside, mitigations can be installed at the levelof the operating system, the application software, the electronicequipment architecture and at the upper level of the overall systemarchitecture.

All of the methods previously described can be coupled in such a way asto optimise the level of protection of the component and/or of theoperation that it performs.

Nevertheless, the installation of all of these methods is not an easytask, as they are specific to a given component and application. Theycan be subjected to a production error due to their implementationcomplexity. In addition, their level of efficiency is not necessarilyknown in advance. Indeed, according to certain technological parametersand in particular to the component's logic architecture, some mitigationtechniques reveal themselves to be inefficient in the event of multipleerrors. Although, due to the integration of electronic components,multiple errors, due to interaction with a single particle, are becomingmore and more frequent. The efficiency of mitigation techniquesimplemented for the component, equipment and system must thus beassessed. On the other hand, the specific use of a component by a givenapplication can make an otherwise validated mitigation techniqueinefficient.

In document PCT/US2004/022531, a system is known, based on a pulsedlaser focused on the surface of an electronic component for injectingfaults into this electronic component and observing the reaction in itsvoltage and/or power supply. However, in this document, the componenttested is not in the actual situation of running an application. Inaddition, in order to avoid subjecting the component to sustainedaggression, this document provides for synchronising the aggression.Finally, to ensure detecting the effects identified above, sustainedimpulse times of at least more than one microsecond are provided for.The measurements are therefore not realistic.

In this invention, in order to correct this problem, the component ismounted onto a user card and is running its application. In addition,the laser radiation is focused inside the component on the areaspresenting sensitivity to the injection of charges. The card isintegrated or not into a piece of equipment and/or a system. Theinjection of faults enables the level of tolerance of the application totransient or permanent faults to be quantified either directly or afteranalysis, and/or the mitigation techniques implemented to protect theapplication with regards to the same faults to be validated. Repeatingthe aggressions performed by the laser over time and the short durationof these excitations enable the component's reaction to be characterisedin a realistic manner when the application is running.

The invention therefore relates to a method for testing a softwareapplication implemented with an electronic component in an integratedcircuit, in which

-   -   the sensitivity of the application to faults induced by energy        particles within the component in a test installation is        measured when the component is in operation and running the        application,    -   with this test installation, the electronic component is        activated and, due to this activation, the component is        synchronised by a clock signal and has an application cycle        time,    -   operational working conditions being different from static        working conditions in that the component, in operational working        conditions, runs an application operation different to an        internal logistic operation implemented in static working        conditions,    -   the electronic component thus activated is excited by pulsed        laser radiation impulses produced by the test installation,    -   during this test, the component inputs receive input signals,        varying over time, and the component outputs correspondingly        produce output signals, varying over time,    -   a malfunction is measured, occurring in the application run by        the activated electronic component, which corresponds to this        excitation,    -   this malfunction materialises in the application signals,        varying over time, which are different to the expected        application signals, varying over time.

characterised in that, for this measurement,

-   -   the component in an integrated circuit is mounted onto an        electronic board capable of running the application,    -   the electronic board capable of running the application is        placed in the test installation,    -   the excitation impulses are started by an asynchronous or        synchronous signal of this clock signal of the application        cycle.    -   the laser radiation is focused at different depths in the        component, and    -   the duration of the impulses is limited to less than or equal to        one nanosecond.

The invention will be better understood after reading the followingdescription and after examining the accompanying figures. These arepresented as a rough guide and in no way as a limited guide to theinvention. The figures show:

FIG. 1: A schematic representation of a device capable of being used toimplement the method of the invention;

FIG. 2: A temporal diagram showing the component's clock signals, laserimpulse dates of the invention and the cycle times of the applicationimplemented;

FIG. 3: For an area of interest according to the invention, a criticalenergy rise, for which the interactions are critical, according to afocus depth and a choice of excitation energy.

FIG. 1 shows a device capable of being used to implement the method ofthe invention. The purpose of the invention is to measure the effects ofenergy interactions within an electronic component 1. The electroniccomponent 1 is thus comprised, in a known manner and presented upsidedown, of a semiconductor crystal 2 into which various introductions aremade: the housings and areas introduced with impurities. Connections,typically metallic connections such as 3 open onto a connectioninterface 4 of the electronic component 1. The semiconductor plate 2 canbe coated with a layer of protection 5, for example metallisation. Thelayer of protection 5 is located on the opposite side of the crystal 2to the side where connections 3 are made.

In the invention, in order to measure the malfunctions of theapplication run by an electronic component 1, which would be subjectedto energy interactions, this component 1 is mounted onto a monolayer ormultilayer, printed circuit board-type, electronic board 6. Board 6 canbe an actual user card for component 1. To this effect, board 6 iscomprised of other components such as 7 and 8, pin-type connectioncomponents 9 crossing board 6 or solder ball-type components such as 10for surface-mounted components. In the example, component 1 is asurface-mounted type component with solder balls connected tometallisations 3, but this is not a requirement.

Board 6 is fitted with components 7 and 8, which are used for itscorrect operation. For example, these components are clock crystal-typecomponents, transmission filters, decoupling components, changeovers orswitches, or even microcontrollers. Component 1 can be, for example, amicroprocessor, with or without an integrated associated memory or aprogrammable logic component (FPGA).

Board 6 is fitted with a connector 11. In the invention, this connector11 is used to connect board 6 to the test apparatus. Connector 11 isconnected in the board to tracks such as 12 leading to components 1, 7and 8. Tracks 12 can be distributed throughout the thickness 13 of theboard for a multilayer-type electronic board.

In order to measure the sensitivity of component 1 and of theapplication to energy particles, a test apparatus is used. With thisapparatus, component 1 is excited by means of a laser source 14. Thislaser source 14 emits a radiation 15, which aggresses electroniccomponent 1. In order to promote this aggression, component 1 ispreferably subjected to this aggression via its base 5. In order topromote this aggression, layer of protection 5 is preferably open (inparticular by a chemical or mechanical process) in a window 16, throughwhich the radiation 15 from laser 14 can penetrate.

At the time of the test, the electronic component 1 is connected via itsinterface 11 to a power supply and control device 17. Device 17 iscomprised, in a schematic manner, of a microprocessor 18 connected by acontrol, address and data bus 19 to a programme memory 20, a data memory21, interface 11, laser source 14 and a system 32 for attenuating thelaser energy. Device 17 also comprises, represented schematically, acomparator 22 receiving on the one hand on a control voltage input 23,an expected electrical magnitude and on a measurement input 24,electrical signals from the application sampled by interface 11 whencomponent 1 is subjected to the interactions and excitations from laser14. This part of the device enables the application malfunctions to beidentified. The magnitude 23 can be that produced by another boardidentical to board 6, synchronised with the latter, but which is notsubjected to aggression.

In an operational manner, device 17 also comprises another comparatorreceiving on the one hand on a control voltage input, an expectedelectrical magnitude of the component and on a measurement input,electrical signals sampled by interface 11 in component 1, when thelatter is subjected to the interactions and excitations from laser 14.This optional part of the device enables the faults of component 1 to beidentified.

In practice, there can be two comparators: a first, optional comparator,which enables component failure to be measured, and a second comparatorwhich enables a corresponding application failure to be measured. Thefirst comparator can, for example, include a programme to, after beingsubjected to an aggression, read a memory cell or a registry and verifyits content, when this memory cell or this registry are not solicited bythe application. The second comparator measures the application's outputsignals to verify their coherency.

The comparators can be replaced by a routine 25 for measuring thecoherency of the signal received by the application and/or by theelectronic component 1 with an expected signal. The measurementoperation can be static: in this event, only the values of thepotentials and currents available on the contacts of interface 11 aretested. It is essentially dynamic in nature. In this event,microprocessor 18 also comprises a clock, which separates certainoperations whose running must have a known history, and it is measuredto discover whether this history is reproduced in an expected manner orif there are any anomalies.

The programme memory 20 comprises to this effect, a control programme 26for the laser source 14, its movements XYZ, its power level and itsstart times. Finally, memory 20 is preferably comprised of a controlprogramme 27 for operating board 6. According to this operation, board 6runs the application for which it is designed: processing input datareceived on its connections 3, possibly originating from bus 19, andproducing output data, mainly applied to bus 19 or other components 7and 8 of board 6. The two programmes 26 and 27 can run simultaneously,sequentially or asynchronously. Programme 26 can take into account thephases of programme 27 to opportunely launch the excitations at chosentimes.

FIG. 2 shows a first temporal diagram 33 separating the impulses from atiming clock of component 1. This clock can be mounted onto board 1 orconnected to bus 19. Preferably, its impulses are managed, or at leasttaken into account by programme 26. A second temporal diagram 34 showsthe temporal distribution of the short duration laser impulses, such as35, emitted at times 36 to 42, set or not with respect to a specificsignal from clock 33. A third temporal diagram 43 shows action phases 44to 46 of component 1. These action phases correspond to the actions,complex operations, selection, calculation, reformatting, transmission,verification or other actions performed by component 1 within the scopeof the application implemented with board 16. A cycle time 47 for theapplication can thus be defined as the time during which one or severalprocessing phases are performed. According to the invention, it is thusimportant that dates 36 to 42 are chosen, or at least distributed, withrespect to these application cycles, which are different to a cycle 48of clock 33. It is important that these impulses 35 are distributedduring cycle 47, and not when they are placed at a given time withrespect to the start 49 or the end 50 of any impulse from clock 33.

In a classic manner, a known method, particularly with microprocessor18, involves moving the source 14 in the directions XY at the surface ofcrystal 2 with the use of an actuator 28. By performing this move, thelocations of interest can be located, where the interactions between theradiation 14 and the semiconductor component 1 are measured to be thestrongest, or even critical. However, this knowledge is insufficient. Itdoes not provide information concerning the depth.

The hole formed by window 16 can be smaller than the width of plate 2 ofcomponent 1. The trace of the impact of radiation 15 on the surface ofcomponent 1 is naturally less than hole 16, as otherwise, the X and Yscanning of window 16 would be useless.

With such a technique, the areas of interest in component 1 are locatedin the sense where there areas are the focal points for interactionswhich are harmful to the correct operation of component 1 and/or of theapplication. The purpose of the invention is to discover whether thecomponent will, in any place in its structure, be the focal point for aharmful interaction.

In the invention, in order to obtain this result, the laser radiation 15is focused with the use of a focus device, represented schematically bya lens 29, and a focus depth of a focal point 30 of radiation 15 thusfocused is varied with the use of this lens 29. For example, a depth 31shown here is located underneath interface 2-5. The refractive index ofcrystal 2, which is different to the refractive index of the air, isnaturally taken into account. This is not shown in FIG. 1, where thefocused radiation has rectilinear beams 34. According to the invention,for each focus depth, the energy interactions of the radiation oncomponent 1 are measured. The principle of this measurement is asfollows.

As soon as the laser source 14 is positioned opposite an area ofinterest, for a first given focus, for example on interface 2-5, thelevel of attenuation of the laser energy is adjusted by the controlstransmitted to actuator 32 with the use of microprocessor 18 and bus 19,and source 14 is controlled with the use of microprocessor 18 and bus19, in order to create a laser impulse. The reduction of the level ofattenuation of actuator 32 causes an energy increase to the laser. Thisincrease results in an increase in power of the laser positioned incomponent 1.

In practice, this administration of energy excitations is pulsed (inparticular so as to prevent the component from overheating due tocontinuous illumination). In order to make the measurements realistic,it was discovered that the impulse should be very short, for examplelasting approximately one hundred picoseconds or even less, andtherefore in all cases, of a duration of less than or equal to onenanosecond.

In addition, preferably, but not as an obligation, the change in powercan be performed in steps. From an experimental point of view, thestarting point is the highest value of laser energy (power), and this isreduced until the critical value is obtained (however the opposite isalso possible: from the lowest value of energy, progressivelyincreasing). For each impulse and at the end of the impulse, thecoherency of the signals read in component 1 and at the level of theapplication with respect to the expected signals is measured. If thiscoherency is correct, the attenuation is reduced. At a given moment intime, a critical power level is reached, for which, for the first time,the electronic reaction from the application or component 1 is no longeras expected. The value of this critical power level is noted.

Then, the focus of the laser source is changed, for example by movinglens 29 towards component 1 (or possibly by using a variable focallens), in such a way that the focal point 30 penetrates further intocrystal 2. For this other in-depth position of this focal point 30, theoperation by increase is reiterated (an operation by reduction can alsobe performed), and a new critical power value is obtained. By acting inthis way, an in-depth mapping and not merely a surface mapping of themalfunction of electronic component 1 can be obtained.

The laser beam is incident by the rear side, on the side of thesubstrate of component 1. If the laser beam does not penetrate themetallisations, irradiation by the rear side is preferable to reveal allof the sensitive areas. Mounting onto electronic board 6 is thereforefully compatible with the method, and it enables window 16 to be opened.

For a given impulse time, the critical energy level corresponds to acritical power level. If the critical energy curve, also known as thethreshold energy, is traced according to the focus depth in theconfiguration of FIG. 1, it will have an appearance as represented inFIG. 3. Using this curve (researching the minimum value) provides thedepth of the sensitive are of collection. Indeed, the critical area isthe area where the least power is required from laser 14 in order todisturb the correct operation of component 1.

For one position of interest, the focus of the laser beam is adjusted insuch a way as to identify the focus for which the component presents amaximum level of sensitivity with respect to a laser impulse. Thismaximum level of sensitivity is obtained when the level of laser energyrequired to cause the failure is minimal. This operation is performedfor a position of interest, but can also be repeated systematically forall of the positions of the laser mapping or possibly for positionschosen at random. For example, FIG. 3, for a given position XY, aminimal energy level 51 was found to be required at a depth 52 to causea failure. At any other depth, a level of laser energy higher thanenergy level 51 was required. Thus, the minimum of the experimentalcurve characterising the evolution of the threshold energy according tothe focus depth, corresponds to the depth at which the sensitive area islocated.

Then, for a level of laser energy higher than this minimum energy level,therefore higher than this energy level 51, the laser beam is moved withrespect to the component, in a known or random manner, over all or partof the surface of the latter, over all or part of its depth, for all ofpart of phases 44 to 46. For a certain number of positions and for times36 to 42, a laser fire is performed, synchronised or not with respect toa signal 33 and a check is performed on the test system to check whetherone or several failures (faults within the component or applicationmalfunctions) have occurred.

A laser must be used, for which the designed material of component 1 isnot transparent (by linear or nonlinear absorption mechanism). In theevent of linear absorption, the energy level from the photon laser mustbe higher than the potential barrier at the forbidden band of thesemiconductor. For silicon, the wavelength of the laser must be smallerthan 1.1 micrometers.

Thus, the minimum value of the experimental curve characterising theevolution of the threshold energy according to the focus depthcorresponds to the depth at which the sensitive area is located.

If its properties are well chosen, as well as the particles, a pulsedand focused laser enables the semiconductor constituting the electroniccomponents to be ionised locally and in a transient manner, causingtransient or permanent faults in the component running the application.In order to achieve this, the laser must have a wavelength enablingcharges to be generated (by linear or nonlinear absorption mechanism) inthe material making up the component.

The nonlinear absorption mechanism corresponds to an excitation withseveral photons. Several photons are absorbed simultaneously by thesemiconductor material. The sum of energy from these photons is enoughto cause a fault. The advantage of the latter mechanism is that itenables improved spatial resolution, in depth within the component andon the plane of this component. A more precise location of themultiphoton impact thus enables the operation of the application to becharacterised in more detail with respect to the aggressions.

For example, in the event of linear absorption in silicon, thewavelength of the laser must be lower than 1.1 μm. The laser ispreferably used in single-impulse mode or synchronised with respect to asignal from the component or the application undergoing testing. Anoptical system is used to focus the laser radiation at the level of thecomponent's active areas. Finally, there is a system on the optical pathlength of the laser beam, enabling the level of laser energy to bemodified. This system has an interface which enables it to be controlledfrom a computer.

All of the elements can be controlled in order to enable the test to beautomated.

The positions and times of the laser fires can be chosen at random toreproduce the impact of the particles from the natural environment ornot, or on the contrary, they can be carefully adjusted so as to locatethe spatial and temporal positions causing faults to the component andcausing the application to malfunction. In addition, in each position,the level of laser energy can be adjusted and the same position testedagain until no more faults are measured and/or no further malfunction ofthe application is observed, which enables a mapping of the sensitivityof the component and associated application to be drawn up.

This procedure can be performed for the component and application forwhich no mitigation technique has been applied, as well as for thecomponent and application for which a mitigation technique has beenapplied. Comparing the two measures proves the effect of mitigation. Ifthe application run by the component malfunctions, the mitigation isimplemented and the procedure is repeated. This procedure can beperformed on an isolated component on a board 6 and on which anapplication is installed, or on a component 1 included on a board 6,itself included in its actual environment.

Table 1 hereinafter shows the different verification and measurementoperations which can be performed according to this method. The symbol Ysignifies yes, the symbol N signifies no.

TABLE 1 Operations A B C D E F G H I J K L Laser fire with sufficientenergy N Y Y Y Y Y Y Y Y Y Y Application failure control - reset if N YY Y Y Y Y Y Y Y Y required Component failure control - reset if Y Y Y YY Y Y Y Y N required Control and reset of the component or Y Y Y Y Y Y YY N N application between each laser fire? Mapping (spatial injection offaults Y Y Y Y N N N N — — controlled at different energy levels)Spatial injection of faults at random and N N N N Y Y Y Y — — atdifferent energy levels Determination of the energy threshold Y Y Y Y YY Y Y Y Y of the application failure Determination of the energythreshold Y Y Y Y Y Y Y Y Y N of the component failure Temporalsynchronisation possible with Y Y N N Y Y N N — — respect to theapplication? Temporal synchronisation possible with Y N Y N Y N Y N — —respect to a signal from the component?

According to the results obtained by the test device in reaction tothese operations in situations A to L, the conclusions to be drawn withrespect to test validity, component validity or validity of the softwareapplication tested are as follows.

Situation A: Increase the energy level and restart

Situation B: Not applicable

Situation C: A spatial and temporal mapping was drawn up of the failuresoccurring at the level of the component and application, spatial andtemporal locations were identified as responsible for the component andapplication failures and an exhaustive observation of the modes offailure was performed, the dynamic efficient area of the component wasmeasured (number of failures per laser fire), and the dynamic efficientarea of the application was measured (number of failures per laser fire)

Situation D: A spatial mapping was drawn up of the failures occurring atthe level of the component—a spatial and temporal mapping was drawn upof the failures occurring at the level of the application, spatial andtemporal locations were identified as responsible for the applicationfailures—spatial locations were identified as responsible for thecomponent failures, an exhaustive observation of the modes of failurewas performed spatially and an exhaustive observation of the modes ofapplication failure was performed temporally, the dynamic efficient areaof the component was measured (number of failures per laser fire), andthe dynamic efficient area of the application was measured (number offailures per laser fire)

Situation E: A spatial and temporal mapping was drawn up of the failuresoccurring at the level of the component—a spatial mapping was drawn upof the application failures, spatial and temporal locations wereidentified as responsible for the component failures, spatial locationswere identified as responsible for the application failures, anexhaustive observation of the modes of failure was performed spatiallyand a statistic observation temporally, the dynamic efficient area ofthe component was measured (number of failures per laser fire), and thedynamic efficient area of the application was measured (number offailures per laser fire)

Situation F: A spatial mapping was drawn up of the failures occurring atthe level of the component and application, spatial locations wereidentified as responsible for the component and application failures, anexhaustive observation of the modes of failure was performed spatiallyand a statistic observation temporally, the dynamic efficient area ofthe component was measured (number of failures per laser fire), and thedynamic efficient area of the application was measured (number offailures per laser fire)

Situation G: A temporal mapping was drawn up of the failures occurringat the level of the component and application, temporal locations wereidentified as responsible for the component and application failures, anexhaustive observation of the modes of failure was performed temporallyand a statistic observation spatially, the dynamic efficient area of thecomponent was measured (number of failures per laser fire), and thedynamic efficient area of the application was measured (number offailures per laser fire)

Situation H: A temporal mapping was drawn up of the failures occurringat the level of the application, temporal locations were identified asresponsible for the application failures, an exhaustive observation ofthe modes of application failure was performed temporally and astatistic observation spatially, the dynamic efficient area of thecomponent was measured (number of failures per laser fire), and thedynamic efficient area of the application was measured (number offailures per laser fire)

Situation I: A temporal mapping was drawn up of the failures occurringat the level of the component, temporal locations were identified asresponsible for the component failures, an exhaustive observation of themodes of component failure was performed temporally and a statisticobservation spatially, the dynamic efficient area of the component wasmeasured (number of failures per laser fire), and the dynamic efficientarea of the application was measured (number of failures per laser fire)

Situation J: A statistic observation of the modes of failure of thecomponent and application was performed both temporally and spatially,similar to that obtained during the tests under a particle accelerator,the dynamic efficient area of the component was measured (number offailures per laser fire), and the dynamic efficient area of theapplication was measured (number of failures per laser fire), thedynamic efficient area of the component was measured (number of failuresper laser fire), and the dynamic efficient area of the application wasmeasured (number of failures per laser fire)

Situation K: Accumulation of failures within the component, multipleerrors are not identified, the number of component failures required tocause an application failure was measured according to the time of firewith respect to the application cycle, the static efficient area of thecomponent was measured (total number of failures with respect to thetotal number of laser fires), and the static efficient area of theapplication was measured (total number of failures with respect to thetotal number of laser fires)

Situation L: Accumulation of failures within the component, multipleerrors are not identified, the static efficient area of the applicationwas measured (total number of failures with respect to the total numberof laser fires)

1. A method for testing a software application implemented with anelectronic component in an integrated circuit in which the sensitivityof the application to faults induced by energy particles within thecomponent in a test installation is measured when the component is inoperation and running the application, with this test installation, theelectronic component is activated and, due to this activation, thecomponent is synchronised by a clock signal with an application cycletime, operational working conditions being different from static workingconditions in that the component, in operational working conditions,runs an application operation, different to an internal logisticoperation, the method comprising: exciting the activated electroniccomponent by pulsed laser radiation impulses produced by the testinstallation, wherein, during this test, the component inputs receiveinput signals, varying over time, and the component outputscorrespondingly produce output signals, varying over time, measuring amalfunction, occurring in the application run by the activatedelectronic component, which corresponds to this excitation, wherein thismalfunction materialises in the application signals, varying over time,which are different to the expected application signals, varying overtime, and wherein, for this measurement, the component in an integratedcircuit is mounted onto an electronic board capable of running theapplication, placing the electronic board capable of running theapplication in the test installation, starting the excitation impulsesby an asynchronous or synchronous signal of this clock signal and/or ofthe application cycler, focusing the laser radiation at different depthsin the component, and limiting the duration of the impulses to less thanor equal to one nanosecond.
 2. A method according to claim 1, wherein onan application run by a component and which presents malfunctions aftera test performed according to this method, implementing a mitigation,and reiterating the test steps to verify the efficiency of thismitigation,
 3. A method according to claim 1, wherein the cycle timewith respect to the start time for the laser excitation, is the timetaken by the component to perform a complex operation.
 4. A methodaccording to claim 1, further including focusing the laser radiation atdifferent depths in the component in order to obtain a location ofinterest identifying the focus, for which the component presents maximalsensitivity wherein, this maximal sensitivity is obtained when the levelof laser energy required to cause a fault is minimal, and then,subjecting different places in the component to a level of laser energyhigher than this minimal energy level.
 5. A method according to claim 1,further including for a given depth, varying the laser power, in steps,and determining a critical power level of the laser, above which theinteraction becomes critical.
 6. A method according to claim 1, furtherincluding exciting the component by one side of a plate of thiscomponent, this side preferably being opposite side on which theimpurity introductions are made, this component being fitted withmetallisations on the side opposite to this plate.
 7. A method accordingto claim 6, further including making a small hole in a layer ofprotection of the component plate, in such a way as to at least reachthe silicon, this small hole having a surface area lower than the totalsurface area of the component plate, this small hole having a surfacearea higher than the trace of an impact from the laser radiation on thecomponent.
 8. A method according to claim 1, further including measuringthe interaction by comparing an output signal from the component orboard to an expected value, or by comparing an action generated by theboard to an expected action, and detecting conditions under which thiscomparison is no longer compliant with a criteria.
 9. A method accordingto claim 1, wherein a level of photon laser energy of the laser sourceis higher than the value of a forbidden band of the semiconductorcomponent or if the level of photon energy is lower than the value ofthe forbidden band of the semiconductor component, a multiphotonabsorption system is implemented.
 10. A method according to claim 1,wherein the laser source causes the simultaneous absorption of severalphotons in the semiconductor material.
 11. A device for implementing themethod according to claim 1.